> ## Documentation Index
> Fetch the complete documentation index at: https://trust.denialbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Incident response

> How Denialbase detects, investigates, communicates about, and recovers from security incidents.

<Warning>
  **Status — April 2026**: Our incident response framework is operational for technical detection and containment, but the **formal Incident Response Plan (IRP)** with named responders, escalation trees, and tabletop-tested runbooks is in draft. Target publication: Q2 2026. See [SOC 2 readiness](/trust/soc2-iso27001).

  The mitigations and commitments on this page are live today; the formalization is in progress.
</Warning>

## Report an incident or vulnerability

<Card title="security@denialbase.com" icon="envelope" href="mailto:security@denialbase.com">
  Send a detailed description of what you observed. Include timestamps, affected accounts, and any reproduction steps. PGP key available on request. We acknowledge within **2 business days**.
</Card>

<Card title="Customer-facing outage or active attack" icon="siren" href="mailto:security@denialbase.com">
  For anything in progress affecting customer data, mark the email subject with `[URGENT]`. On-call engineer paged directly.
</Card>

## Severity levels

| Level     | Example                                                                                        | Response time              | Owner                      |
| --------- | ---------------------------------------------------------------------------------------------- | -------------------------- | -------------------------- |
| **Sev-1** | Confirmed PHI breach, prolonged platform outage, active attack                                 | 15 min ack / 1 hr response | CTO + Security Officer     |
| **Sev-2** | Suspected data exposure, degraded service for many customers, authentication subsystem failure | 1 hr ack / 4 hr response   | On-call + Security Officer |
| **Sev-3** | Single-customer issue, non-PHI data issue, low-severity vuln                                   | Next business day          | On-call                    |
| **Sev-4** | Minor bug, cosmetic issue, non-security report                                                 | Normal triage queue        | Support                    |

## Response phases

<Steps>
  <Step title="Detect">
    * Automated alerts (Cloud Monitoring) on failed-login spikes, bulk exports, off-hours admin, auth subsystem anomalies.
    * External reports via [security@denialbase.com](mailto:security@denialbase.com).
    * Sentry error-rate alerts.
  </Step>

  <Step title="Triage">
    On-call engineer confirms the signal, assigns severity, and creates an incident record. PHI involvement is a hard triage question at this step.
  </Step>

  <Step title="Contain">
    * Revoke compromised credentials, disable affected accounts, block abusive IPs at Cloud Armor.
    * Isolate affected services (scale down, disable integrations, invalidate sessions).
    * Preserve evidence — snapshot databases, capture logs, disable destructive cleanup jobs.
  </Step>

  <Step title="Eradicate & recover">
    * Identify and patch the root cause.
    * Restore affected services to known-good state.
    * Rotate any potentially exposed secrets.
  </Step>

  <Step title="Notify">
    * Covered-entity customers notified per the BAA breach clause within 60 days of discovery, earlier where possible.
    * Regulators notified per HIPAA §164.408 if ≥500 individuals affected.
    * Status page updated for any customer-visible impact.
  </Step>

  <Step title="Post-incident review">
    * Blameless post-mortem within 5 business days of resolution.
    * Remediation items tracked with owner + target date.
    * Published internally; sanitized summary provided to customers on request.
  </Step>
</Steps>

## HIPAA breach assessment

If PHI may have been affected, we run a §164.402 probability-of-compromise assessment considering:

1. The nature and extent of the PHI involved.
2. The unauthorized person or system who obtained it.
3. Whether the PHI was actually acquired or viewed.
4. The extent to which risk has been mitigated.

The outcome (breach confirmed / low-probability exception) is documented regardless. Low-probability findings are retained in our incident file for 6 years.

## Coordinated disclosure

Security researchers who find and report vulnerabilities responsibly will receive:

* Acknowledgement within 2 business days.
* Reasonable coordination on public disclosure timing (typically ≤90 days).
* Credit in our security changelog (with permission).
* At this time we do not pay bug bounties, but we'd like to change that — contact us if you find something serious.

## Current limitations — honest status

<AccordionGroup>
  <Accordion title="No formal 24/7 SOC">
    We have on-call rotation for service outages; for security-specific events we rely on automated alerts routed to the on-call engineer, with escalation to the Security Officer. A dedicated SOC or third-party MDR is on the roadmap once pentest and IRP formalization complete.
  </Accordion>

  <Accordion title="No tabletop exercises run yet">
    IRP tabletop exercises are planned for Q2 2026 immediately after the plan is finalized. Findings will be rolled back into this page.
  </Accordion>

  <Accordion title="Pentest not yet contracted">
    First third-party pentest engagement targeted for Q3 2026. See [Penetration testing](/trust/penetration-testing).
  </Accordion>
</AccordionGroup>